@cleocode/core 2026.6.12 → 2026.6.14

package/migrations/drizzle-brain/20260610000001_t10405-bitemporal-network-columns/migration.sql

@@ -0,0 +1,71 @@
+-- T10405 (SG-PSYCHE-FOUNDATION · Tier 5): bitemporal `expired_at` + four-network `network`.
+--
+-- Completes the Graphiti 4-timestamp bitemporal model on the four BRAIN tables.
+-- Prior schema shipped created_at + valid_at + invalid_at; this migration adds the
+-- 4th timestamp `expired_at` (TRANSACTION-time end — when a row was retracted from
+-- the active store, distinct from `invalid_at` = VALID-time end). It also adds the
+-- four-network classification column `network` (world / bank / opinion / observation
+-- per masterplan §16.D Mem0-V3 envelope). Both columns are declared in
+-- memory-schema.ts; this file is their forward Drizzle DDL (T9179 precedent —
+-- columns reach a fresh DB via Drizzle, never via the retired ensureColumns()).
+--
+-- Per-table `network` DEFAULT matches the row's cognitive role:
+--   brain_decisions    → 'bank'        (durable account-of-record)
+--   brain_patterns     → 'world'       (objective recurring behaviour)
+--   brain_learnings    → 'opinion'     (evaluative belief, updates on evidence)
+--   brain_observations → 'observation' (raw episodic event)
+--
+-- The enum is enforced in-app (no SQLite CHECK constraint — Lesson 3 convention).
+-- All statements are ALTER TABLE ADD COLUMN / CREATE INDEX IF NOT EXISTS → atomic
+-- + idempotent on SQLite 3.35+. The migration-manager reconciler marks this
+-- migration applied-without-running when the columns already exist (consolidated
+-- cleo.db path), or executes it directly on a standalone / fresh brain DB.
+--
+-- SAFE FOR: SQLite 3.35+ (ALTER TABLE ADD COLUMN is atomic)
+
+ALTER TABLE brain_decisions ADD COLUMN expired_at TEXT;
+--> statement-breakpoint
+ALTER TABLE brain_decisions ADD COLUMN network TEXT DEFAULT 'bank';
+--> statement-breakpoint
+ALTER TABLE brain_patterns ADD COLUMN expired_at TEXT;
+--> statement-breakpoint
+ALTER TABLE brain_patterns ADD COLUMN network TEXT DEFAULT 'world';
+--> statement-breakpoint
+ALTER TABLE brain_learnings ADD COLUMN expired_at TEXT;
+--> statement-breakpoint
+ALTER TABLE brain_learnings ADD COLUMN network TEXT DEFAULT 'opinion';
+--> statement-breakpoint
+ALTER TABLE brain_observations ADD COLUMN expired_at TEXT;
+--> statement-breakpoint
+ALTER TABLE brain_observations ADD COLUMN network TEXT DEFAULT 'observation';
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS idx_brain_decisions_expired_at
+  ON brain_decisions (expired_at);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS idx_brain_decisions_network
+  ON brain_decisions (network);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS idx_brain_patterns_expired_at
+  ON brain_patterns (expired_at);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS idx_brain_patterns_network
+  ON brain_patterns (network);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS idx_brain_learnings_expired_at
+  ON brain_learnings (expired_at);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS idx_brain_learnings_network
+  ON brain_learnings (network);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS idx_brain_observations_expired_at
+  ON brain_observations (expired_at);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS idx_brain_observations_network
+  ON brain_observations (network);
+--> statement-breakpoint
+-- T10405 (Tier 6): exponential-backoff gate on the derivation queue.
+-- A re-queued item carries `next_attempt_at = now + base * 2^retryCount` so the
+-- worker's claim query skips it until the backoff window elapses (no hot-loop on
+-- a transiently-failing item). NULL = claimable now (default for new items).
+ALTER TABLE deriver_queue ADD COLUMN next_attempt_at TEXT;
+

package/migrations/drizzle-cleo-global/20260607000000_t11891-writer-leases/migration.sql

@@ -0,0 +1,55 @@
+-- T11627 (ST-2) — DbWriterLease arbitration tables (local-mode, daemon-disabled).
+--
+-- Co-located inside EACH scope's consolidated cleo.db (this file is byte-identical
+-- in drizzle-cleo-project and drizzle-cleo-global so the two lineages produce the
+-- SAME migration hash — the consolidated single-file journal converges across both
+-- under the CONSOLIDATED_JOURNAL_LINEAGES cross-lineage guard, T11829).
+--
+-- The lease engine (packages/core/src/store/writer-lease.ts) arbitrates a single
+-- in-process writer per (scope, lane) via BEGIN IMMEDIATE + epoch-CAS over the
+-- `_writer_leases` row, healing the T5158 multi-writer corruption WITHOUT a running
+-- supervisor daemon.
+--
+-- AC1 (at most one active writer per scope/lane) is enforced by the PARTIAL UNIQUE
+-- index `ux_writer_leases_active … WHERE active = 1`. drizzle-orm cannot model a
+-- partial WHERE index, so it is emitted here as raw SQL (the established repo
+-- pattern — cf. project_agent_refs.enabled in conduit-schema). The drizzle schema
+-- (writer-lease-schema.ts) declares ONLY the full-column tables; the runtime
+-- bootstrap asserts this index exists (assertWriterLeaseActiveIndexPresent).
+--
+-- Each statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one.
+-- (The marker token is intentionally NOT spelled out in this comment: drizzle's
+-- readMigrationFiles splits the file on that literal substring, so writing it here
+-- would split the comment mid-line and corrupt statement one.)
+--
+-- @task T11627
+-- @epic T11625
+
+CREATE TABLE IF NOT EXISTS `_writer_leases` (
+  `id` INTEGER PRIMARY KEY,
+  `scope` TEXT NOT NULL,
+  `lane` TEXT NOT NULL,
+  `holder_id` TEXT NOT NULL,
+  `holder_pid` INTEGER NOT NULL,
+  `epoch` INTEGER NOT NULL,
+  `acquired_at` INTEGER NOT NULL,
+  `heartbeat_at` INTEGER NOT NULL,
+  `ttl_ms` INTEGER NOT NULL,
+  `reentrancy_depth` INTEGER NOT NULL DEFAULT 1,
+  `active` INTEGER NOT NULL DEFAULT 1
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_writer_leases_active` ON `_writer_leases` (`scope`, `lane`) WHERE `active` = 1;
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `_writer_queue` (
+  `ticket` INTEGER PRIMARY KEY AUTOINCREMENT,
+  `scope` TEXT NOT NULL,
+  `lane` TEXT NOT NULL,
+  `holder_id` TEXT NOT NULL,
+  `priority` INTEGER NOT NULL DEFAULT 100,
+  `enqueued_at` INTEGER NOT NULL,
+  `deadline_at` INTEGER NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_writer_queue_order` ON `_writer_queue` (`scope`, `lane`, `priority` ASC, `ticket` ASC);

package/migrations/drizzle-cleo-global/20260607010000_t11639-session-manifest/migration.sql

@@ -0,0 +1,43 @@
+-- T11639 (EP-SESSION-MANIFEST · epic T11638) — cross-project `session_manifest`
+-- MIRROR table in the consolidated GLOBAL cleo.db (drizzle-cleo-global scope).
+--
+-- The authoritative session row lives per-project in `tasks_sessions` (PROJECT
+-- scope). A best-effort writer mirrors a compact projection into this GLOBAL row so
+-- the fleet has one machine-wide view of every session across every project without
+-- ATTACHing N per-project DBs. NOT authoritative (deliberately NOT named `sessions`):
+-- reconcile-on-start re-reads the project row and overwrites this row so it can never
+-- drift into authority.
+--
+-- `project_id` is a soft FK → `nexus_project_registry.project_id` (same cleo.db),
+-- nullable for sessions started outside any registered project. `parent_session_id`
+-- is a soft self-reference (fork tree, sourced from CLEO_PARENT_SESSION_ID / T11629),
+-- nullable for root sessions. No native FKs: the mirror must tolerate a project row
+-- that lands before/without its registry/parent peer.
+--
+-- `IF NOT EXISTS` so a re-open over an already-migrated DB is a no-op. Each statement
+-- is separated by a drizzle breakpoint marker so node:sqlite prepare() does not
+-- truncate the multi-statement file to statement one.
+--
+-- @task T11639
+-- @epic T11638
+
+CREATE TABLE IF NOT EXISTS `session_manifest` (
+  `session_id` text PRIMARY KEY NOT NULL,
+  `project_id` text,
+  `parent_session_id` text,
+  `name` text,
+  `status` text,
+  `project_path` text,
+  `started_at` text,
+  `ended_at` text,
+  `mirrored_at` text NOT NULL DEFAULT (datetime('now')),
+  CHECK ("started_at" IS NULL OR "started_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("ended_at" IS NULL OR "ended_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("mirrored_at" IS NULL OR "mirrored_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*')
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_session_manifest_project_id` ON `session_manifest` (`project_id`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_session_manifest_parent` ON `session_manifest` (`parent_session_id`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_session_manifest_status` ON `session_manifest` (`status`);

package/migrations/drizzle-cleo-global/20260608000000_t11899-pi-session-tree/migration.sql

@@ -0,0 +1,52 @@
+-- T11761 (S3 · T11899) — Pi `SessionStorage` tree-persistence tables.
+--
+-- Backs `CleoSessionStorage` (packages/core/src/llm/pi/pi-session-storage.ts):
+-- the durable cleo.db implementation of Pi's tree-structured `SessionStorage`
+-- interface (@earendil-works/pi-agent-core). Every Pi session is a tree of
+-- `SessionTreeEntry` nodes (id / parentId / timestamp / type / payload) plus one
+-- leaf pointer per session; this file is the physical home for both.
+--
+-- Pure runtime infrastructure (like `_writer_leases` from T11627) — NOT part of
+-- the exodus target shape under `schema/cleo-project/`. Co-located inside EACH
+-- scope's consolidated cleo.db via the existing drizzle-cleo-project /
+-- drizzle-cleo-global migration sets; this file is byte-identical across both
+-- lineages so the two produce the SAME migration hash (the consolidated
+-- single-file journal converges across both under CONSOLIDATED_JOURNAL_LINEAGES,
+-- T11829). The Pi adapter resolves PROJECT scope; the global copy keeps the two
+-- lineages' DDL convergent (the lease-table precedent).
+--
+-- ALL writes go through the writer lease (withWriterLease('project', 'bulk', …),
+-- writer-lease.ts:1067) — the adapter NEVER opens a raw writer (Gate 3). These
+-- tables are written by the store accessor (pi-session-store.ts) over the native
+-- handle openDualScopeDb already holds, inside the leased section.
+--
+-- Each statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one
+-- (the marker token is intentionally not spelled out in this comment — drizzle's
+-- readMigrationFiles splits the file on that literal substring).
+--
+-- @task T11899
+-- @task T11761
+-- @epic T10403
+
+CREATE TABLE IF NOT EXISTS `pi_session_entries` (
+  `session_id` TEXT NOT NULL,
+  `entry_id` TEXT NOT NULL,
+  `parent_id` TEXT,
+  `type` TEXT NOT NULL,
+  `payload_json` TEXT NOT NULL,
+  `seq` INTEGER NOT NULL,
+  `ts` TEXT NOT NULL,
+  PRIMARY KEY (`session_id`, `entry_id`)
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_pi_session_entries_seq` ON `pi_session_entries` (`session_id`, `seq` ASC);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_pi_session_entries_parent` ON `pi_session_entries` (`session_id`, `parent_id`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `pi_session_leaf` (
+  `session_id` TEXT PRIMARY KEY,
+  `leaf_id` TEXT,
+  `created_at` TEXT NOT NULL,
+  `updated_at` TEXT NOT NULL
+);

package/migrations/drizzle-cleo-global/20260608010000_t11709-accounts-credential-pool/migration.sql

@@ -0,0 +1,72 @@
+-- T11709 (EP-PROVIDER-VAULT · epic T10410 · saga SG-VAULT-CORE T10409) — the
+-- pooled-LLM-credential `accounts` table in the consolidated GLOBAL cleo.db
+-- (drizzle-cleo-global scope ONLY — this is a cross-project, machine-wide
+-- credential pool with no project-tier analog, so it is NOT mirrored into
+-- drizzle-cleo-project).
+--
+-- One row per LLM credential ("account") for one provider: the encrypted
+-- secret/refresh material plus rotation / cooldown / health metadata the pool
+-- runner consults to select the next live account and retire dead ones. Replaces
+-- the legacy plaintext JSON blob with a queryable, `cleo health`-visible table.
+--
+-- `secret_enc` / `refresh_enc` are encryptGlobal() ciphertext (T11710), NEVER
+-- plaintext. This is DISTINCT from `agent_registry_accounts` (the better-auth
+-- OAuth-account table) — different physical name, different purpose.
+--
+-- ## Active-account pointer (raw partial unique index)
+--
+-- `is_active` is the per-provider "currently-selected" pointer: AT MOST ONE row
+-- per `provider` may carry `is_active = 1`. drizzle-orm cannot model a partial
+-- `WHERE` unique index, so it is emitted here as raw SQL (the established repo
+-- pattern — cf. `_writer_leases.active`, T11627 · `project_agent_refs.enabled`).
+-- The drizzle schema (accounts.ts) declares only the full-column table plus the
+-- non-partial `(provider, label)` unique index that drizzle CAN emit.
+--
+-- ## Page-2 invariant
+--
+-- This migration runs AFTER the consolidation baseline (…_t11363-consolidation-
+-- cleo-global) which already creates dozens of tables, so `accounts` is NEVER the
+-- first CREATE on a fresh DB — rootpage 2 is already owned by
+-- `__drizzle_migrations` / the baseline tables. No journal pre-create is required.
+--
+-- `IF NOT EXISTS` so a re-open over an already-migrated DB is a no-op. Each
+-- statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one
+-- (the marker token is intentionally not spelled out in this comment — drizzle's
+-- readMigrationFiles splits the file on that literal substring).
+--
+-- @task T11709
+-- @epic T10410
+-- @saga T10409
+
+CREATE TABLE IF NOT EXISTS `accounts` (
+  `id` integer PRIMARY KEY NOT NULL,
+  `provider` text NOT NULL,
+  `label` text NOT NULL,
+  `auth_type` text NOT NULL,
+  `secret_enc` text,
+  `refresh_enc` text,
+  `expires_at` text,
+  `priority` integer NOT NULL DEFAULT 0,
+  `source` text,
+  `status` text NOT NULL DEFAULT 'ok',
+  `last_error_code` text,
+  `cooldown_reset_at` text,
+  `request_count` integer NOT NULL DEFAULT 0,
+  `metadata` text NOT NULL DEFAULT '{}',
+  `is_active` integer NOT NULL DEFAULT 0,
+  `created_at` text NOT NULL DEFAULT (datetime('now')),
+  `updated_at` text NOT NULL DEFAULT (datetime('now')),
+  CHECK ("status" IN ('ok', 'exhausted', 'dead')),
+  CHECK ("is_active" IN (0, 1)),
+  CHECK ("expires_at" IS NULL OR "expires_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("cooldown_reset_at" IS NULL OR "cooldown_reset_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("created_at" IS NULL OR "created_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("updated_at" IS NULL OR "updated_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*')
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_accounts_provider_label` ON `accounts` (`provider`, `label`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_accounts_active_provider` ON `accounts` (`provider`) WHERE `is_active` = 1;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_accounts_provider_status_priority` ON `accounts` (`provider`, `status`, `priority`);

package/migrations/drizzle-cleo-global/20260608020000_t11889-selfimprove-dhq/migration.sql

@@ -0,0 +1,64 @@
+-- T11889 (T11889-A · T11911) — the self-improvement-loop DHQ sink (`selfimprove_dhq`).
+--
+-- One row per Dogfood-Harness-Question raised by `cleo selfimprove run`: the loop
+-- replays a canned scenario, diffs the LAFS envelopes against a golden, and on
+-- regression UPSERTs exactly ONE row here via the leased Gate-3 accessor
+-- (selfimprove-dhq-store.ts). On green it writes nothing.
+--
+-- Co-located inside EACH scope's consolidated cleo.db (this file is byte-identical
+-- in drizzle-cleo-project and drizzle-cleo-global so the two lineages produce the
+-- SAME migration hash — the consolidated single-file journal converges across both
+-- under the CONSOLIDATED_JOURNAL_LINEAGES cross-lineage guard, T11829). Pure runtime
+-- infrastructure (like `_writer_leases` from T11627 and `pi_session_*` from T11899)
+-- — NOT part of the exodus target shape under `schema/cleo-project/`.
+--
+-- ## Idempotency invariant (partial UNIQUE index)
+--
+-- At most ONE row per `question_hash` may carry `status = 'open'`, so a repeated
+-- regression UPSERTs the same open row instead of spamming duplicates. drizzle-orm
+-- cannot model a partial WHERE unique index, so it is emitted here as raw SQL (the
+-- established repo pattern — cf. `_writer_leases.active`, T11627 ·
+-- `project_agent_refs.enabled`). The drizzle schema (selfimprove-dhq-schema.ts)
+-- declares ONLY the full-column table plus the two non-partial indexes drizzle CAN
+-- emit; the runtime bootstrap asserts this partial index exists
+-- (assertSelfimproveDhqOpenIndexPresent).
+--
+-- ## Page-2 invariant
+--
+-- This migration runs AFTER the consolidation baseline (…_t11363-consolidation-
+-- cleo-project) which already creates dozens of tables, so `selfimprove_dhq` is
+-- NEVER the first CREATE on a fresh DB — rootpage 2 is already owned by
+-- `__drizzle_migrations` / the baseline tables. No journal pre-create is required
+-- (the lease cold-open path pre-creates `__drizzle_migrations` before any first
+-- table, so the precondition holds even on a freshly cold-opened DB).
+--
+-- `IF NOT EXISTS` so a re-open over an already-migrated DB is a no-op. Each
+-- statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one
+-- (the marker token is intentionally not spelled out in this comment — drizzle's
+-- readMigrationFiles splits the file on that literal substring).
+--
+-- @task T11889
+-- @task T11911
+-- @epic T11889
+
+CREATE TABLE IF NOT EXISTS `selfimprove_dhq` (
+  `id` INTEGER PRIMARY KEY,
+  `dhq_id` TEXT NOT NULL,
+  `scenario` TEXT NOT NULL,
+  `question_hash` TEXT NOT NULL,
+  `title` TEXT NOT NULL,
+  `regression_json` TEXT NOT NULL,
+  `status` TEXT NOT NULL DEFAULT 'open',
+  `severity` TEXT,
+  `pr_url` TEXT,
+  `run_id` TEXT NOT NULL,
+  `created_at` INTEGER NOT NULL,
+  `updated_at` INTEGER NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_selfimprove_dhq_status` ON `selfimprove_dhq` (`status`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_selfimprove_dhq_scenario` ON `selfimprove_dhq` (`scenario`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_selfimprove_dhq_open` ON `selfimprove_dhq` (`question_hash`) WHERE `status` = 'open';

package/migrations/drizzle-cleo-global/20260609000000_t11937-service-vault/migration.sql

@@ -0,0 +1,93 @@
+-- T11937 (EP-UNIVERSAL-SERVICE-VAULT · epic T11765 · saga SG-VAULT-CORE T10409 ·
+-- M2 W1a) — the universal SERVICE-credential vault in the consolidated GLOBAL
+-- cleo.db (drizzle-cleo-global scope ONLY — machine-wide service credentials with
+-- no project-tier analog, exactly like the `accounts` LLM-credential pool T11709,
+-- so NOT mirrored into drizzle-cleo-project).
+--
+-- Three tables, cannibalized from onecli `app_connections` / `app_configs` /
+-- `agent_app_connections` with EVERY org/project/billing column dropped:
+--
+--   service_connections   — one connected credential per (provider, label);
+--                           credentials_enc = encryptGlobal({access,refresh}) blob.
+--   service_configs        — per-provider BYOC OAuth app (enabled + client_secret_enc).
+--   agent_service_grants   — per-agent access + session_policy (the trust gate
+--                            evaluates this BEFORE any decrypt).
+--
+-- `credentials_enc` / `client_secret_enc` are encryptGlobal() ciphertext (T11710),
+-- NEVER plaintext. These are DISTINCT from the LLM `accounts` table (model-API
+-- credentials) — different physical names, different consumers, shared crypto.
+--
+-- ## Page-2 invariant
+--
+-- This migration runs AFTER the consolidation baseline (…_t11363-consolidation-
+-- cleo-global) which already creates dozens of tables, so none of these tables is
+-- the first CREATE on a fresh DB — rootpage 2 is already owned by
+-- `__drizzle_migrations` / the baseline tables. No journal pre-create is required.
+--
+-- ## Idempotency + breakpoints
+--
+-- `IF NOT EXISTS` on every statement so a re-open over an already-migrated DB is a
+-- no-op. Each statement is separated by a drizzle breakpoint marker line so
+-- node:sqlite prepare() does not silently truncate the multi-statement file to
+-- statement one (the marker token is the literal drizzle readMigrationFiles split
+-- substring — additive/forward-only).
+--
+-- ## CHECK constraints (schema-parity SSoT — T11364)
+--
+-- The consolidated schema-parity gate re-derives the CHECK set from the drizzle
+-- schema metadata (boolean → IN (0,1); enum → IN (...); `_at` TEXT → ISO-8601
+-- GLOB). The CHECKs below MUST match that derivation byte-for-byte.
+--
+-- @task T11937
+-- @epic T11765
+-- @saga T10409
+
+CREATE TABLE IF NOT EXISTS `service_connections` (
+  `id` integer PRIMARY KEY NOT NULL,
+  `provider` text NOT NULL,
+  `label` text NOT NULL,
+  `status` text NOT NULL DEFAULT 'active',
+  `credentials_enc` text,
+  `scopes` text NOT NULL DEFAULT '[]',
+  `expires_at` text,
+  `metadata` text NOT NULL DEFAULT '{}',
+  `connected_at` text NOT NULL DEFAULT (datetime('now')),
+  `updated_at` text NOT NULL DEFAULT (datetime('now')),
+  CHECK ("status" IN ('active', 'expired', 'revoked')),
+  CHECK ("expires_at" IS NULL OR "expires_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("connected_at" IS NULL OR "connected_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("updated_at" IS NULL OR "updated_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*')
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_service_connections_provider_label` ON `service_connections` (`provider`, `label`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_service_connections_provider_status` ON `service_connections` (`provider`, `status`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `service_configs` (
+  `id` integer PRIMARY KEY NOT NULL,
+  `provider` text NOT NULL,
+  `enabled` integer NOT NULL DEFAULT 0,
+  `client_secret_enc` text,
+  `settings` text NOT NULL DEFAULT '{}',
+  `created_at` text NOT NULL DEFAULT (datetime('now')),
+  `updated_at` text NOT NULL DEFAULT (datetime('now')),
+  CHECK ("enabled" IN (0, 1)),
+  CHECK ("created_at" IS NULL OR "created_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("updated_at" IS NULL OR "updated_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*')
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_service_configs_provider` ON `service_configs` (`provider`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `agent_service_grants` (
+  `agent_id` text NOT NULL,
+  `service_connection_id` integer NOT NULL,
+  `session_policy` text NOT NULL DEFAULT '{"mode":"allow"}',
+  `created_at` text NOT NULL DEFAULT (datetime('now')),
+  `updated_at` text NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (`agent_id`, `service_connection_id`),
+  FOREIGN KEY (`service_connection_id`) REFERENCES `service_connections`(`id`),
+  CHECK ("created_at" IS NULL OR "created_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+  CHECK ("updated_at" IS NULL OR "updated_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*')
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_agent_service_grants_agent` ON `agent_service_grants` (`agent_id`);

package/migrations/drizzle-cleo-global/20260609010000_t11733-models-catalog/migration.sql

@@ -0,0 +1,65 @@
+-- T11733 (E8-CATALOG-CURATION · epic T11694) — the `models_catalog` catalog SSoT
+-- table in the consolidated GLOBAL cleo.db (drizzle-cleo-global scope ONLY — the
+-- provider+model capability catalog is a cross-project, machine-wide signal with
+-- no project-tier analog, so it is NOT mirrored into drizzle-cleo-project).
+--
+-- One row per model: the full models.dev wire capability set (modalities, cost,
+-- limits, reasoning/tool-call flags, status, release_date). This table is the
+-- catalog SSoT — seeded from the shipped offline `curated-catalog.json` (T11734),
+-- read table-first via resolveCatalogEntry() (T11737), and consulted by the
+-- resolver default (latest release_date wins — T11944), killing the hardcoded
+-- `claude-haiku-4-5` default literal (which survives only as the offline floor).
+--
+-- This carries NO secrets and NO encryption — it is catalog DATA, distinct from
+-- the `accounts` LLM-credential pool (T11709) and the `service_*` vault (T11937).
+--
+-- ## Page-2 invariant
+--
+-- This migration runs AFTER the consolidation baseline (…_t11363-consolidation-
+-- cleo-global) and many subsequent migrations, so `models_catalog` is NEVER the
+-- first CREATE on a fresh DB — rootpage 2 is already owned by
+-- `__drizzle_migrations` / the baseline tables. No journal pre-create is required.
+--
+-- `IF NOT EXISTS` so a re-open over an already-migrated DB is a no-op (idempotent).
+-- Each statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one
+-- (the marker token is intentionally not spelled out in this comment — drizzle's
+-- readMigrationFiles splits the file on that literal substring).
+--
+-- @task T11733
+-- @epic T11694
+
+CREATE TABLE IF NOT EXISTS `models_catalog` (
+  `id` text PRIMARY KEY NOT NULL,
+  `provider_id` text NOT NULL,
+  `name` text NOT NULL,
+  `family` text NOT NULL,
+  `attachment` integer NOT NULL DEFAULT 0,
+  `reasoning` integer NOT NULL DEFAULT 0,
+  `temperature` integer NOT NULL DEFAULT 1,
+  `interleaved` integer NOT NULL DEFAULT 0,
+  `tool_call` integer NOT NULL DEFAULT 0,
+  `modalities` text NOT NULL DEFAULT '{"input":["text"],"output":["text"]}',
+  `cost` text NOT NULL DEFAULT '{}',
+  `context_limit` integer,
+  `output_limit` integer,
+  `status` text NOT NULL DEFAULT 'stable',
+  `release_date` text NOT NULL,
+  `models_dev_id` text NOT NULL,
+  `source` text NOT NULL DEFAULT 'seed',
+  `seeded_at` text NOT NULL DEFAULT (datetime('now')),
+  CHECK ("status" IN ('stable', 'beta', 'preview', 'deprecated', 'retired')),
+  CHECK ("attachment" IN (0, 1)),
+  CHECK ("reasoning" IN (0, 1)),
+  CHECK ("temperature" IN (0, 1)),
+  CHECK ("interleaved" IN (0, 1)),
+  CHECK ("tool_call" IN (0, 1)),
+  CHECK ("release_date" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]'),
+  CHECK ("seeded_at" IS NULL OR "seeded_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*')
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_models_catalog_provider_modeldev` ON `models_catalog` (`provider_id`, `models_dev_id`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_models_catalog_provider_release` ON `models_catalog` (`provider_id`, `release_date`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_models_catalog_provider_status` ON `models_catalog` (`provider_id`, `status`);

package/migrations/drizzle-cleo-global/20260609020000_t11703-providers/migration.sql

@@ -0,0 +1,52 @@
+-- T11703 (M3 Provider SSoT · epic T11667) — the `providers` declarative-provider
+-- SSoT table in the consolidated GLOBAL cleo.db (drizzle-cleo-global scope ONLY —
+-- the provider definition set is a cross-project, machine-wide signal with no
+-- project-tier analog, so it is NOT mirrored into drizzle-cleo-project).
+--
+-- One row per provider: the serializable ProviderDef (T11702) — identity, aliases,
+-- auth methods, wire endpoint(s) (tagged-union JSON discriminated on `transport`),
+-- models.dev catalog key, default headers, optional OAuth flow, declarative request
+-- quirks. This table is the provider SSoT — seeded from the builtin ProviderDef set
+-- derived from the in-process ProviderProfile builtins (T11703), and read by the
+-- resolver / CLI / alias resolver (T11704). The non-serializable runtime hooks stay
+-- on ProviderProfile; a row carries only DATA.
+--
+-- This carries NO secrets and NO encryption — it is declarative config DATA, distinct
+-- from the `accounts` LLM-credential pool (T11709), the `service_*` vault (T11937),
+-- and the `models_catalog` catalog (T11733). The OAuth `client_id` it stores is the
+-- provider's PUBLIC first-party id; client SECRETS live in the service vault.
+--
+-- ## Page-2 invariant
+--
+-- This migration runs AFTER the consolidation baseline (…_t11363-consolidation-
+-- cleo-global) and many subsequent migrations, so `providers` is NEVER the first
+-- CREATE on a fresh DB — rootpage 2 is already owned by `__drizzle_migrations` /
+-- the baseline tables. No journal pre-create is required.
+--
+-- `IF NOT EXISTS` so a re-open over an already-migrated DB is a no-op (idempotent).
+-- Each statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one
+-- (the marker token is intentionally not spelled out in this comment — drizzle's
+-- readMigrationFiles splits the file on that literal substring).
+--
+-- @task T11703
+-- @epic T11667
+
+CREATE TABLE IF NOT EXISTS `providers` (
+  `id` text PRIMARY KEY NOT NULL,
+  `display_name` text NOT NULL,
+  `aliases` text NOT NULL DEFAULT '[]',
+  `auth_methods` text NOT NULL DEFAULT '[]',
+  `endpoint` text NOT NULL,
+  `alt_endpoints` text NOT NULL DEFAULT '[]',
+  `models_dev_id` text NOT NULL,
+  `default_headers` text NOT NULL DEFAULT '{}',
+  `env_vars` text NOT NULL DEFAULT '[]',
+  `oauth` text,
+  `request_quirks` text NOT NULL DEFAULT '[]',
+  `source` text NOT NULL DEFAULT 'seed',
+  `seeded_at` text NOT NULL DEFAULT (datetime('now')),
+  CHECK ("seeded_at" IS NULL OR "seeded_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*')
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_providers_models_dev` ON `providers` (`models_dev_id`);

package/migrations/drizzle-cleo-global/20260610000000_t11962-schedules/migration.sql

@@ -0,0 +1,48 @@
+-- T11962 (under T11679) — the cron/todo schedule sink (`schedules`).
+--
+-- One row per recurring schedule registered by the `cron_schedule` agent tool
+-- (T11950): a cron expression + the task template (title / description)
+-- materialized on each fire, an `enabled` flag, and create/update timestamps. The
+-- tool registers a row daemon-OFF via the leased Gate-3 accessor
+-- (schedule-store.ts); a future daemon scheduler consumes the SAME table as a
+-- separate reader (AC4).
+--
+-- Co-located inside EACH scope's consolidated cleo.db (this file is byte-identical
+-- in drizzle-cleo-project and drizzle-cleo-global so the two lineages produce the
+-- SAME migration hash — the consolidated single-file journal converges across both
+-- under the CONSOLIDATED_JOURNAL_LINEAGES cross-lineage guard, T11829). Pure
+-- runtime infrastructure (like `_writer_leases` from T11627, `pi_session_*` from
+-- T11899, and `selfimprove_dhq` from T11911) — NOT part of the exodus target shape
+-- under `schema/cleo-project/`, so the consolidated schema-parity gate (T11364)
+-- does not re-derive its CHECK set.
+--
+-- ## Page-2 invariant
+--
+-- This migration runs AFTER the consolidation baseline (…_t11363-consolidation-
+-- cleo-project) which already creates dozens of tables, so `schedules` is NEVER
+-- the first CREATE on a fresh DB — rootpage 2 is already owned by
+-- `__drizzle_migrations` / the baseline tables.
+--
+-- `IF NOT EXISTS` so a re-open over an already-migrated DB is a no-op. Each
+-- statement is separated by a drizzle breakpoint marker line so node:sqlite
+-- prepare() does not silently truncate the multi-statement file to statement one
+-- (the marker token is intentionally not spelled out in this comment — drizzle's
+-- readMigrationFiles splits the file on that literal substring).
+--
+-- @task T11962
+-- @epic T11679
+
+CREATE TABLE IF NOT EXISTS `schedules` (
+  `id` INTEGER PRIMARY KEY,
+  `schedule_id` TEXT NOT NULL,
+  `cron_expr` TEXT NOT NULL,
+  `title` TEXT NOT NULL,
+  `description` TEXT,
+  `enabled` INTEGER NOT NULL DEFAULT 1 CHECK (`enabled` IN (0, 1)),
+  `created_at` TEXT NOT NULL DEFAULT (datetime('now')),
+  `updated_at` TEXT NOT NULL DEFAULT (datetime('now'))
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ux_schedules_schedule_id` ON `schedules` (`schedule_id`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ix_schedules_enabled` ON `schedules` (`enabled`);